Fixes a minor security issue, debdiff below. All tests were fine.

Cheers,
        Moritz

diff -Nru transmission-4.1.0~beta2+dfsg/debian/changelog transmission-4.1.0~beta2+dfsg/debian/changelog
--- transmission-4.1.0~beta2+dfsg/debian/changelog	2025-08-23 18:17:20.000000000 +0200
+++ transmission-4.1.0~beta2+dfsg/debian/changelog	2026-09-01 00:05:34.000000000 +0200
@@ -1,3 +1,9 @@
+transmission (4.1.0~beta2+dfsg-3+deb13u2) trixie; urgency=medium
+
+  * CVE-2026-38978
+
+ -- Moritz Mühlenhoff <jmm@debian.org>  Tue, 01 Sep 2026 00:05:34 +0200
+
 transmission (4.1.0~beta2+dfsg-3+deb13u1) trixie; urgency=medium

   * fix GTK app crash when LANG=fr (Closes: #1108194, #1110257)
diff -Nru transmission-4.1.0~beta2+dfsg/debian/patches/CVE-2026-38978.patch transmission-4.1.0~beta2+dfsg/debian/patches/CVE-2026-38978.patch
--- transmission-4.1.0~beta2+dfsg/debian/patches/CVE-2026-38978.patch	1970-01-01 01:00:00.000000000 +0100
+++ transmission-4.1.0~beta2+dfsg/debian/patches/CVE-2026-38978.patch	2026-09-01 00:05:34.000000000 +0200
@@ -0,0 +1,33 @@
+From e51d77e202206ee1389cbd6d9ab154421942b530 Mon Sep 17 00:00:00 2001
+From: Charles Kerr <charles@charleskerr.com>
+Date: Tue, 31 Mar 2026 09:13:32 -0500
+Subject: [PATCH] fix: add clickjack safeguards when serving http responses
+ (#8747) (#8749)
+
+--- transmission-4.1.0~beta2+dfsg.orig/libtransmission/rpc-server.cc
++++ transmission-4.1.0~beta2+dfsg/libtransmission/rpc-server.cc
+@@ -175,7 +175,15 @@ namespace
+ {
+ int constexpr DeflateLevel = 6; // medium / default
+
+-// ---
++// Prevent clickjacking on the browser-facing WebUI and RPC responses.
++// https://github.com/transmission/transmission/issues/8726
++// https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html.
++void add_clickjacking_prevention_headers(struct evkeyvalq* headers)
++{
++    // Send X-Frame-Options for older browsers + CSP frame-ancestors for newer ones
++    evhttp_add_header(headers, "X-Frame-Options", "SAMEORIGIN");
++    evhttp_add_header(headers, "Content-Security-Policy", "frame-ancestors 'self'");
++}
+
+ void send_simple_response(struct evhttp_request* req, int code, char const* text = nullptr)
+ {
+@@ -499,6 +507,7 @@ void handle_request(struct evhttp_reques
+
+     auto* const output_headers = evhttp_request_get_output_headers(req);
+     evhttp_add_header(output_headers, "Server", MY_REALM);
++    add_clickjacking_prevention_headers(output_headers);
+
+     if (server->is_anti_brute_force_enabled() && server->login_attempts_ >= server->settings().anti_brute_force_limit)
+     {
diff -Nru transmission-4.1.0~beta2+dfsg/debian/patches/series transmission-4.1.0~beta2+dfsg/debian/patches/series
--- transmission-4.1.0~beta2+dfsg/debian/patches/series	2025-08-20 11:41:32.000000000 +0200
+++ transmission-4.1.0~beta2+dfsg/debian/patches/series	2026-09-01 00:05:34.000000000 +0200
@@ -5,3 +5,4 @@
 web-easier-build.patch
 0003-disable-git-hook-installation.patch
 0004-do-not-mess-revision.patch
+CVE-2026-38978.patch